The present system relates to the field of network troubleshooting and analysis and particularly to a system and method of comparing activity data files to identify differences between the data files that may be of interest.
As the prevalence of network applications continues to grow, so does the need for improved speed and performance associated with these applications. During both the development and deployment of an application it is often critical to identify the impact of the network on the application and the impact of the application on the network. This is often accomplished by recording the network activity, such as network traffic, occurring across the network while the application is being tested, deployed, run, etc. The recorded traffic is typically stored in data files, such as network trace files, which may be subsequently analyzed to identify a cause of application performance problems.
In a typical scenario, a network engineer may suspect a source of a particular problem. The engineer may attempt to identify the potential problem referring to a trace file. To verify whether a determined source of network problems has been properly identified, the engineer may make a change to the network or application in an effort to alleviate the problem or reduce an effect of the problem. For example, in a case where data collisions are an expected cause of application problems, traffic may be partially rerouted to other nodes in the network in an attempt to alleviate the problem. As may be readily appreciated, other adjustments to network operating conditions may be similarly attempted to alleviate a network problem. After enacting a change, the impact of the change may then be analyzed by recording a new trace and comparing the new trace with the trace from before the change.
Analysis of the performance of a network requires examining network activity, such as traffic, that may be directly or indirectly related to the enacted change or that may be totally unrelated. The actual comparison, however, often proves to be a very difficult task. Unrelated changes to the network may have occurred during the time between the traces, and the network conditions, such as network traffic, might vary substantially. Accordingly, a direct comparison of the two trace files may yield a significant quantity of unrelated differences, thereby further complicating the task of identifying differences in the trace files that are attributable to the enacted change in the network. As may be readily appreciated, it is the differences in the data files (e.g., trace file) that are attributable to the enacted change that represent the differences/changes of interest.
Prior systems enable comparing the content of text files, web pages, as well as other types of documents and file formats. Prior systems also enable comparing two or more trace files by calculating statistical information from the trace files and displaying the statistical information in a comparative manner, such as side-by-side. This type of report is called a comparison report. However, in order for the comparison report to be useful, the user must be aware of where to look for differences and how to decipher them once they are found. Such awareness is a significant barrier in complex traces, and therefore a solution is required that aids the user in identifying and analyzing these differences. Further, prior systems provide little or no ability other than manual observations and operations to discern between all differences in network activity and differences in network activity that are of interest (e.g., are attributable to an enacted change).
It is an object of the present system to overcome disadvantages and/or make improvements in the prior art.
The present system includes a system, method and device for identifying differences between activity data files. A difference is determined between the activity data files. Causal analysis may be performed to identify a cause of the difference. The difference and/or the cause of the difference may be rendered based on a rendering template. Tier pairs between the activity data files may be matched. Matching tier pairs may include querying a user to confirm the tier pair match. Statistical and/or protocol differences between each of the activity files may be presented. The differences may be determined based on an analysis of corresponding activity data files.
Transactions between each of the activity data files may be matched. Matching may include comparing the content of a file that accounts for a transaction in a first one of the activity data files to content of a file that accounts for a transaction in a second one of the activity data files. Client side differences between each of the activity data files may be identified. A categorization may be assigned to each of the determined differences. Determined differences may be excluded from the rendering based on criteria. The template may be modified by the user prior to rendering the differences. The differences may be rendered at two or more levels of resolution. The two or more levels of resolution may be selectable within a single user interface, such as by selection of depicted tabs that are each associated with one of the two or more levels of resolution.
The differences may be rendered on a display device within a graphical user interface and/or may be rendered to a data file in tabular form. The difference may be rendered in a hierarchical format. A value for each of the activity data files that accounts for the difference may be rendered. An indicator may also be rendered comparing one of the values to another one of the values. Details of each of the activity data files may be rendered indicating if each of the details are matched, moved or unique between the activity data files.